At StoryLurker, we take your privacy seriously. This Privacy Policy explains what information we collect, how we use and share it, the legal bases we rely on, and the rights you have. It applies to the StoryLurker website and services.

Who We Are

StoryLurker ("we", "us", or "our") is operated by an individual. We are the controller responsible for the personal information described in this policy. We are not affiliated with, endorsed by, or connected to Instagram or Meta Platforms, Inc. For any privacy question, or to exercise your rights, contact us at privacy@storylurker.com or through our contact page.

Information We Collect

Information You Provide

Account Information: If you register, we collect your username, email address, and password (which is stored only as a secure hash, never in plain text). You may optionally provide a display name.
Contact Information: If you contact us, we collect your name, email address, and the contents of your message.

Information Collected Automatically

Usage Data: We log the Instagram usernames you search for, timestamps, the type of content viewed (such as stories or highlights), and counts related to your usage and any credits used.
Device & Connection Data: We record your IP address and browser user-agent string, and associate activity with a session identifier. We use this for security, abuse prevention, rate limiting, and operating the service.
Cookies & Similar Technologies: We use cookies to maintain your session and remember preferences, and (with consent where required) for advertising. See our Cookie Policy for details.

How We Use Your Information

To provide, operate, and maintain our service
To manage your account and provide customer support
To enforce usage limits, manage credits, and prevent abuse or fraud
To maintain the security and integrity of our service
To improve our service and develop new features
To display advertising through Google AdSense (personalized only where you consent)
To comply with our legal obligations and enforce our terms

Legal Bases for Processing (EEA & UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:

Performance of a contract: to create and manage your account and provide the features you request.
Legitimate interests: to secure our service, prevent abuse and fraud, enforce usage limits, and understand and improve how the service is used — balanced against your rights.
Consent: to set advertising cookies and serve personalized ads, and for any other processing where we ask for your consent. You may withdraw consent at any time.
Legal obligation: where we must process data to comply with the law or respond to lawful requests.

Information Sharing

We do not sell your personal information for money. However, our use of advertising and analytics technologies may be considered a "sale" or "sharing" of personal information under certain U.S. state laws — see Your U.S. State Privacy Rights below. We may share information with:

Service Providers: Third parties that help us operate the service, such as our hosting provider and email delivery provider, acting on our instructions.
Advertising Partners: Google, which operates AdSense and (where you consent) may use cookies and identifiers for personalized advertising and measurement.
Legal & Safety: When required by law, to respond to lawful requests, or to protect the rights, safety, and property of our users, the public, or us.
Business Transfers: In connection with a merger, acquisition, or sale of assets, in which case we will require any recipient to honor this policy.

International Data Transfers

We are based in the United States and our service providers, including Google, may process your information in the United States and other countries. These countries may have data-protection laws that differ from those in your country. Where we transfer personal information from the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. / UK Data Privacy Framework.

Data Security

We implement reasonable technical and organizational measures designed to protect your information, including:

Storing passwords only as secure, salted hashes
Encrypting data in transit using HTTPS
Session protections, including CSRF protection and session expiry
Access controls limiting who can access stored data

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Retention

We keep personal information only for as long as necessary for the purposes described in this policy:

Account data: for as long as your account is active, and then deleted or anonymized within a reasonable period after you close it, unless we must retain it to meet a legal obligation or resolve disputes.
Usage and security logs: retained for a limited period for security, abuse prevention, and analysis, and then deleted or anonymized.
Contact messages: retained for as long as needed to handle your request and for our records.

You can request deletion of your account and associated data at any time (see "Your Rights" below).

Your Rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your data
Object to or restrict certain processing
Request data portability
Withdraw consent at any time (without affecting prior processing)

To exercise these rights, email us at privacy@storylurker.com or use our contact page. We will respond within the time required by applicable law. If you are in the EEA or UK and believe we have not handled your data properly, you also have the right to lodge a complaint with your local data protection authority.

Your U.S. State Privacy Rights (California & Others)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we collect, to request access or deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information and of targeted advertising. We do not exchange personal information for money, but our use of advertising cookies may be treated as a "sale" or "sharing" under these laws.

To opt out, you can: adjust your cookie-consent choices on our site; use Google Ads Settings; or enable a Global Privacy Control (GPC) signal in your browser, which we honor as an opt-out request where required by law. We will not discriminate against you for exercising your privacy rights.

Third-Party Services

Our service relies on or links to third-party services:

Instagram / Meta: We access publicly available data through Instagram's platform. We are not affiliated with Instagram or Meta.
Google AdSense: We use Google AdSense for advertising. Google may use cookies and collect data in accordance with its Privacy Policy.
Google Fonts & Content Delivery Networks: Our pages load fonts and scripts from Google and other CDNs, which receive your IP address when your browser connects to them.

Children's Privacy

Our service is not intended for children under 13 years of age, and we do not knowingly collect personal information from children under 13. In the European Economic Area and the United Kingdom, the minimum age for consent-based processing is 16 (or the lower age set by your country, but not below 13). If you believe a child has provided us with personal information, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date. For material changes, we will take additional steps to notify you where required by law. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy or how we handle your information, email us at privacy@storylurker.com or use our contact page.